8

In Arch Linux, how can I create a single md5 hash for a password using the command line? Of course, I am aware that there are secure password hashing algorithms available, which md5 is not, but this is just part of an experiment.

  • 4
    You might remove the word "more" before "secure". As in, there are secure hashes out there (or at least hashes with some amount of security), MD5 isn't one of them. – Todd Wilcox Sep 21 '16 at 2:28
  • 2
    Just for the record, even a secure cryptographic hash like SHA-256 doesn't directly make a good password hash. I know you at least need something like a salt to defeat rainbow-table attacks, and I'm sure there are other issues that I'm not aware of. – Peter Cordes Sep 21 '16 at 10:26
18

Simply echo it to md5sum.

The first result will consider a newline character in the end of the string, prior to generating the hash.

$ echo P@ssword1 | md5sum
0a43c426e3d6764fe1f3f7cbb3579eba  -

Otherwise as @AFH states if you wish to not have a newline character do the following:

$ echo -n 'P@ssword1' | md5sum
d106b29303767527fc11214f1b325fb6  -
  • 9
    This includes a new-line character along with the password: this may be what the questioner wants, but if not you need echo -n 'P@ssword1' | md5sum. I have included quotes in the password in case it includes characters which the shell interprets; I used single quotes to inhibit expansion if there is a $. – AFH Sep 20 '16 at 14:56
  • 7
    This will return the wrong result, because you're not hashing P@ssword1, but P@ssword1<Newline>. Use echo -n P@ssword1 | md5sum instead. – phihag Sep 20 '16 at 14:56
  • @AFH I expanded on the answer from your comment. – Unfundednut Sep 20 '16 at 14:58
  • 5
    "The first result will return a newline character with the hash." No, it'll consider a newline character when generating the hash, which is a very different thing! – Lightness Races in Orbit Sep 20 '16 at 16:01
  • My working was off. Correct. – Unfundednut Sep 20 '16 at 16:01
11

None of the answers mention that with echo -n 'password' | …, you will write your password to persistent storage, namely your history.

You can avoid this, depending on the shell, by prefixing the command with a space (test this for your shell). Read up on your shells documentation on how this is handled.

Alternatively, you can use md5sum directly, by running md5sum, typing the password and then Ctrl+D. Do not hit Enter between the password and Ctrl+D, unless you want to have include a newline in the hash.

  • 1
    You started so well (+1)... but after you said that to write the plane password in a file works too (-1) 8-O (how many security holes it opens...). BTW if the variable $HISTCONTROL is set to ignorespace or to ignoreboth all the commands entered with a leading-space will not be stored in the history...Nonetheless it's always a good idea to test it directly. (+1 again :-) )... – Hastur Sep 21 '16 at 10:22
  • @Hastur Good point. Writing to a file is generally better than having the password spilled in the history, because you can simply unlink the file (which may not work with the history, depending on configuration – I have seen shells which (re-)write the history on exit). You are however right that getting writing the password to a file right isn’t as easy as simply running vim or something (one would at least want to set the umask, and I don’t know for sure whether that leaves any holes). I removed the part from the answer. – Jonas Schäfer Sep 21 '16 at 12:24
  • I notice your edit (but I've just upvoted I cannot twice, but I can think to something else...). – Hastur Sep 21 '16 at 12:33
8

Here is an example using openssl

echo -n 'stack overflow' | openssl md5
(stdin)= 481b8423202598ecfb233c5fa68caf68

Openssl implement several different hashing algorithms, if you need a different one some day.

4

It seems like everyone is suggesting to use echo -- at least, most of the time, thankfully, with -n, which alleviates one of its problems (that it prints a newline at the end).

But echo isn't necessarily consistent. It has a number of behavioral quirks that you need to keep in mind, and can be incompatible between systems. It's better to use printf instead.

Hence, you should be using

$ printf '%s' 'P@ssword1' | md5sum
d106b29303767527fc11214f1b325fb6  -
$

With printf, if you want a newline at the end, you have to explicitly add it yourself:

$ printf '%s\n' 'P@ssword1' | md5sum
0a43c426e3d6764fe1f3f7cbb3579eba  -
$ echo 'P@ssword1' | md5sum
0a43c426e3d6764fe1f3f7cbb3579eba  -
$

instead of having to ask to not get it (and hoping echo works the same on the system this happens to be running on at some later point):

$ echo -n 'P@ssword1' | md5sum
d106b29303767527fc11214f1b325fb6  -
$

To expand on the point on the quirks of echo that I mentioned above, here are a few:

  • It works differently on various systems. Many modern systems support -n to tell echo to not terminate the output with a newline, but some might not. And what if you want to actually print -n? Some implementations might actually differ based on settings in the shell or environment.
  • It handles, or might not handle, some character sequences (particularly backslash-escaped characters) in a special way. It's not entirely unreasonable to have those in passwords, and POSIX doesn't guarantee anything about the behavior of echo (its behavior is specifically undefined) if the first argument is -n or any of its arguments contain backslashes.

The answers to the above-linked question on using printf instead of echo have several more, as well as further links for more reading if you are curious.

  • "It (echo) has a number of behavioral quirks that you need to keep in mind" Can you expand on this? – DavidPostill Sep 23 '16 at 6:58
  • @DavidPostill I added a bit on that. Do you feel that this is better? – a CVn Sep 23 '16 at 18:12
  • Perfect :) It was for my own education (I didn't want to imply there was anything wrong with your answer). – DavidPostill Sep 23 '16 at 18:14
  • @DavidPostill No worries; I like to try to make my answers as good as they can reasonably be, even when they aren't the top voted ones! (I didn't expect this to garner significant attention even when I started writing it, but felt it was worth having an answer discussing how printf is probably a better choice than echo particularly for something like this.) – a CVn Sep 23 '16 at 18:19
  • That goes for me too :) – DavidPostill Sep 23 '16 at 18:20
3

The question suggests something else to me, so for completeness:

There is an MD5-based salted password hashing method, which replaced the original DES-based crypt() for use in /etc/shadow. It has been replaced by newer things now, but if you ever encounter "MD5 password hashing" in the wild, it may refer to this rather than a plain MD5.

These MD5-based hashes are marked by the prefix $1$ and you can calculate them with openssl passwd -1

0

You can easily do this using echo and md5sum:

 echo -n "password" | md5sum
  • 2
    Without -n the echo will append the newline character to the output, so, the hash will be incorrect. For instance, for echo -n lolwut | md5sum the result is 05a208028929fd77cfb5b08096a837df, while for echo lolwut | md5sum it's f291ceceddd9e13a0ab68cf1829ef583. – Ivan Kolmychek Sep 20 '16 at 15:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.